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EXAMINER'S AMENDMENT 

1 . An examiner's amendment to tine record appears below. Sliould tine clianges 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Joshua D. Mather on 05/05/2009. 

2. The application has been amended as follows: 

• Claim 1 . (Currently Amended) A method for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), 
comprising: 

receiving alert messages corresponding to status events in the storage 
area network, each status event having a corresponding event category and 
severity value, the storage area network having nodes that include manageable 
entities, the manageable entities responsive to a server in the storage area 
network, the nodes including storage entities, connectivity entities, and database 
entities : 

aggregating the alert messages according to event category and severity 
value to generate a category specific severity ranking of the alert messages; 

displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each 
chart entry having a node entry for each node having status attributable to the 
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alert messages, the status array is an N by M matrix of the plurality of chart 
entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in 
the storage area network: 

ii) a storage chart entry indicating alert status of managed storage entities 
in the storage area network: 

ill) a host chart entry indicating alert status of managed host entities in the 
storage area network: and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network: 

receiving a selection of at least one node in the N by M status array matrix 
of the plurality of chart entries: 

displaying the status array including simultaneously listing, for each 
category type, nodes having status events of greatest severity: 

displaying, within at least one chart entry, node entries in relation to the 
selected at least one node in order to display the simultaneous status of nodes in 
the storage area network: and 

displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node. 
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• Claim 2. (Previously Presented) The method of claim 1 wherein 
displaying, within the at least one chart entry, comprises: 

accumulating events of each of a plurality of severity levels, each 
severity level representing a range of severity values such that a given 
status event with a given severity value has a corresponding severity level 
when the given severity value of the given status event is within a range of 
severity values for the corresponding severity level, wherein the severity 
scale for a node entry is an enumeration of events received for each of the 
plurality of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry; 

displaying the enumeration of events received for each node entry 
within the at least one chart entry containing that node entry, the 
enumeration of events received being displayed in an order according to 
the severity ranking; and 

wherein the alert messages are received from remote agents 
operating within a storage area network. 

• Claim 3. (Original) The method of claim 2 wherein the enumeration is a 
histogram having a magnitude based on the severity scale and a quantity 
of events within each severity level within the severity ranking. 

• Claim 4. (Original) The method of claim 3 wherein the histogram has a 
plurality of visually overlapping elongated bar segments, each elongated 
bar segment corresponding to a particular severity level. 
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• Claim 5. (Original) The method of claim 1 further including discovering a 
topology of nodes in the SAN, wherein the alert messages correspond to 
status events for each of a plurality of selected nodes in a selection tree, 
the selection tree indicative of the nodes in the SAN. 

• Claim 6. (Original) The method of claim 1 further including filtering the 
status events to compute a subset of elected events, wherein the received 
events correspond to elected events determined in response to 
predetermined filtering logic at the agents processing the elected events. 

• Claim 7. (Original) The method of claim 1 wherein each chart entry has a 
magnitude axis, the magnitude axis indicative of a relative range of the 
quantity of status events within each of the severity levels corresponding 
to a plurality of node entries reflected in the chart entry. 

• Claim 8. (Previously Presented) The method of claim 1 wherein each chart 
entry has a manageable entity axis, the manageable entity axis arranged, 
for each node, according to increasing severity scale denoting the severity 
ranking for each node included in the chart entry, and further comprising 
computing the severity scale for each node according to a predetermined 
severity metric. 

• Claim 9. (Original) The method of claim 1 wherein the severity level 
corresponds to a threshold value, the threshold value identifying triggering 
of an event having the corresponding severity level. 
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• Claim 1 0. (Original) The method of claim 1 wherein each event in an event 
category has a set of threshold values, the threshold values indicative of a 
quantitative metric triggering the particular event and severity. 

• Claim 1 1 . (Original) The method of claim 1 0 further comprising processing 
and propagating the threshold values to remote agents, the remote agents 
operable to analyze nodes and determine when a particular metric 
satisfying a triggering threshold is attained and generate the 
corresponding event. 

• Claim 12. (Original) The method of claim 1 wherein the nodes further 
comprise manageable entities, the manageable entities responsive to the 
server in a SAN and further including storage entities, connectivity entities, 
and database entities. 

• Claim 13. (Original) The method of claim 1 further comprising selectively 
suppressing events of a particular category and severity. 

• Claim 14. (Original) The method of claim 1 wherein the chart entries in the 
status array are further subdivided into chart entries directed to 
manageable entity health, manageable entity performance, and storage 
system capacity. 

• Claim 15. (Original) The method of claim 1 comprising: 

receiving a selection of at least one node in a hierarchical arrangement 
of nodes; and 
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wherein receiving, aggregating, displaying a status array, and 
displaying, within at least one chart entry, node entries are performed in 
relation to the selected at least one node in order to display the simultaneous 
status of nodes in a storage area network. 

• Claim 17. (Original) The method of claim 1 further comprising 

receiving a user input corresponding to selection of at least 
one node entry from among the node entries displayed in the status 
array; 

displaying an expanded menu of status options for the 
selected entry; and 

receiving a response to the menus of status options and displaying 
an expanded status report corresponding to the expanded menu. 

• Claim 1 8. (Currently Amended) A network monitoring device for gathering 
and monitoring the simultaneous status of nodes in a storage area 
network (SAN), comprising: 

a server having a correlator operable to receive alert messages 
corresponding to status events in the storage area network, each status 
event having a corresponding event category and severity value, the 
storage area network having nodes that include manageable entities, the 
manageable entities responsive to a server in the storage area network, 
the nodes including storage entities, connectivity entities, and database 
entities : 
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an aggregator operable to aggregate the alert messages according 
to event category and severity value to generate a category specific 
severity ranking of the alert messages; and 

an operator console operable to display a status array having a 
plurality of chart entries, each chart entry corresponding to alert messages 
of a particular event category and each chart entry having a node entry for 
each node having status attributable to the alert messages, the status 
array is an N bv M matrix of the plurality of chart entries, the plurality of 
chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network: 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network: 

iii^ a host chart entry indicating alert status of managed host entities 
in the storage area network: and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network: 

the console further operable to receive a selection of at least one 
node in the N bv M status array matrix of the plurality of chart entries, 
display the status array including simultaneously listing, for each category 
type, nodes having status events of greatest severity, and display, within 
at least one chart entry, node entries in relation to the selection of at least 
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one node in order to display the simultaneous status of nodes in the 
storage area network; and 

the console further operable to display, within at least one chart entry, 
node entries having a status event associated with the event category for 
that chart entry, the node entries displayed in the chart entry according to 
the severity ranking and each node entry indicative of a severity scale of 
status for the corresponding effected node. 
• Claim 19. (Previously Presented) The network monitoring device of claim 
18 wherein the accumulator is further operable to: 

accumulate events of each of a plurality of seventy levels, each 
severity level representing a range of severity values such that a given 
status event with a given severity value has a corresponding severity level 
when the given severity value of the given status event is within a range of 
severity values for the corresponding severity level, wherein the severity 
scale for a node entry is an enumeration of events received for each of the 
plurality of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry; 

display, within the at least one chart entry, the enumeration of events 
received for each node entry within the at least one chart entry containing 
that node entry, the enumeration of events received being displayed in an 
order according to the severity ranking; 
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wherein tlie enumeration is a liistogram having a magnitude based on 
the severity scale and a quantity of events within each severity level within 
the severity ranking; and 

wherein the histogram has a plurality of visually overlapping 
elongated bar segments, each elongated bar segment corresponding to a 
particular severity level. 

• Claim 24. (Original) The network monitoring device of claim 1 8 wherein 
each chart entry has a magnitude axis, the magnitude axis indicative of a 
relative range of the quantity of status events within each of the severity 
levels corresponding to a plurality of node entries reflected in the chart 
entry. 

• Claim 25. (Previously Presented) The network monitoring device of claim 
18 wherein each chart entry has a manageable entity axis, the 
manageable entity axis arranged, for each node, according to increasing 
seventy scale denoting the severity ranking for each node included in the 
chart entry, and further comprising computing the severity scale for each 
node according to a predetermined severity metric. 

• Claim 26. (Original) The network monitoring device of claim 1 8 wherein 
the severity level corresponds to a threshold value, the threshold value 
identifying triggering of an event having the corresponding severity level. 

• Claim 27. (Currently Amended) The network monitoring device of claim 1 8 
wherein each event in an event category has a set of threshold values, the 
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threshold values indicative of a quantitative metric triggering the particular 
event and severity; and 

wherein the server is further operable to processing and 
propagating the threshold values to remote agents, the remote agents 
operable to analyze nodes and determine when a particular metric 
satisfying a triggering threshold is attained and generate the 
corresponding event. 

• Claim 30. (Original) The network monitoring device of claim 18 wherein 
the server is operable to selectively suppress events of a particular 
category and severity. 

• Claim 31 . (Original) The network monitoring device of claim 1 8 wherein 
the chart entries in the status array are further subdivided into chart 
entries directed to manageable entity health, manageable entity 
performance, and storage system capacity. 

• Claim 32. (Original) The network monitoring device of claim 18 wherein 
the server is further operable to receive a selection of at least one node in 
a hierarchical arrangement of nodes, and display, within at least one chart 
entry, node entries in relation to the selected at least one node in order to 
display the simultaneous status of nodes in a storage area network. 

• 34. (Original) The network monitoring device of claim 1 8 wherein the 
server is further operable to: 
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receive a user input corresponding to selection of at least one node 
entry from among the node entries displayed in the status array; 

display an expanded menu of status options for the selected entry; and 

display an expanded status report corresponding to the expanded 
menu and a response to the menu of status options. 
• 35. (Currently Amended) A computer program product having a computer 
readable medium operable to store computer program logic embodied in 
computer program code encoded thereon for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), 
comprising: 

computer program code for receiving alert messages corresponding to 
status events in the storage area network, each status event having a 

corresponding event category and seventy value, the storage area 
network having nodes that include manageable entities, the manageable 
entities responsive to a server in the storage area network, the nodes 
including storage entities, connectivity entities, and database entities : 

computer program code for aggregating the alert messages 
according to event category and severity value to generate a category 
specific severity ranking of the alert messages; 

computer program code for displaying a status array having a 
plurality of chart entries, each chart entry corresponding to alert messages 
of a particular event category and each chart entry having a node entry for 
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each node having status attributable to the alert messages, the status 
array is an N by M matrix of the plurality of chart entries, the plurality of 
chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entitles In the storage area network; 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network: 

ill) a host chart entry indicating alert status of managed host entities 
in the storage area network: and 

iy) a connectiyity chart entry indicating alert status of managed 
connectiyity entities in the storage area network: 

computer program code for receiying a selection of at least one 
node in the N by M status array matrix of the plurality of chart entries; 

computer program code for displaying the status array Including 
simultaneously listing, for each category type, nodes haying status eyents 
of greatest seyerity; 

computer program code for displaying, within at least one chart 
entry, node entries in relation to the selected at least one node in order to 
display the simultaneous status of nodes in the storage area network ; and 

computer program code for displaying, within at least one chart 
entry, node entries haying a status eyent associated with the eyent 
category for that chart entry, the node entries displayed in the chart entry 
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according to tlie severity ranl^ing and each node entry indicative of a 
severity scale of status for the corresponding effected node. 

• Claim 38. (Previously Presented) The method of claim 1 , wherein the 
severity scale for each node entry is an aggregate value representative of 
a number of alert messages received at each node entry for a given 
sampling interval, wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with 
a given severity value has a corresponding severity level when the given 
severity value of the given status event is within a range of severity values 
for the corresponding severity level. 

• Claim 39. (Previously Presented) The network monitoring device of claim 
18, wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry 
for a given sampling interval, wherein each node entry is weighted with 
respect to a corresponding severity level for each alert message, each 
severity level representing a range of severity values such that a given 
status event with a given severity value has a corresponding severity level 
when the given severity value of the given status event is within a range of 
severity values for the corresponding severity level. 

• Claim 40. (Previously Presented) The computer program product of 
claim 35, wherein the severity scale for each node entry is an aggregate 
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value representative of a number of alert messages received at each node 
entry for a given sampling interval, wherein each node entry is weighted 
with respect to a corresponding severity level for each alert message, 
each severity level representing a range of severity values such that a 
given status event with a given severity value has a corresponding 
severity level when the given severity value of the given status event is 
within a range of severity values for the corresponding severity level. 
• Claim 43. (Currently Amended) A method for gathering and monitoring 
the simultaneous status of nodes in a storage area network (SAN), 
comprising: 

discovering a topology of nodes in the SAN, wherein the nodes 
comprise manageable entities, the manageable entities responsive to a 
server in the SAN and further including storage entities, connectivity 
entities, and database entities; 

propagating threshold values to remote agents, wherein responsive 
to the threshold values, the remote agents operable to analyze nodes and 
determine when a particular metric satisfying a triggering threshold is 
attained, and to generate a corresponding status event as an alert 
message; 

receiving alert messages, from the remote agents, corresponding to 
status events in the storage area network, each status event having a 
corresponding event category and severity value; 
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storing status events in an event repository; 

aggregating the alert messages according to event category and 
severity value to generate a category specific severity ranking of the alert 
messages; 

displaying a status array having a plurality of chart entries, each 
chart entry corresponding to alert messages of a particular event category 
and each chart entry having a node entry for each node having status 
attributable to the alert messages, the status array is an N bv M matrix of 
the plurality of chart entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network; 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network: 

iii^ a host chart entry indicating alert status of managed host entities 
in the storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network: 

displaying the status array including simultaneously listing, for each 
category type, nodes having status events of greatest severity: 

displaying, within at least one chart entry, node entries in relation to 
the selected at least one node in order to display the simultaneous status 
of nodes in the storage area network: and 
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displaying, witliin at least one chart entry, node entries having a 
status event associated with the event category for that chart entry, the 
node entries displayed in the chart entry according to the severity ranking 
and each node entry indicative of a severity scale of status for the 
corresponding effected node, wherein the severity scale for a node entry 
is an enumeration of events received for each of a plurality of severity 
levels with the severity ranking. 

• Claim 44. (Previously Presented) The method of claim 43 wherein the 
chart entries in the status array are further subdivided into chart entries 
directed to manageable entity health, manageable entity performance, and 
storage system capacity; and 

in response to a user request, the remote agents selectively 
suppressing events of a particular category and seventy. 

• Claim 45. (Previously Presented) The method of claim 4, wherein 
displaying the enumeration of events includes displaying a histogram bar, 
for each node entry, that has a length proportional to a total number of 
status events corresponding to a node of the node entry. 

• Claim 46. (Previously Presented) The method of claim 45, wherein 
displaying the enumeration of events includes displaying each elongated 
bar segment indicating a quantity of status events corresponding to a 
corresponding severity level. 
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• Claim 47. (Previously Presented) The method of claim 46, wherein each 
histogram bar has a maximum range that adjusts depending on a length of 
each histogram bar. 

• Claim 48. (Previously Presented) The method of claim 7, wherein the 
magnitude axis of each chart entry has a maximum range that adjusts 
depending on a maximum value of the severity levels. 

• Claim 50. (Previously Presented) The method of claim 49, further 
comprising: 

accumulating events of each of a plurality of severity levels, each 
severity level representing a range of severity values such that a given 
status event with a given severity value has a corresponding severity level 
when the given severity value of the given status event is within a range of 
severity values for the corresponding severity level, wherein the severity 
scale for a node entry is an enumeration of events received for each of the 
plurality of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry; 

propagating threshold values to remote agents, wherein responsive 
to the threshold values, the remote agents operable to analyze nodes and 
determine when a particular metric satisfying a triggering threshold is 
attained, and to generate a corresponding status event as an alert 
message; and 
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in response to a user request, tlie remote agents selectively 
suppressing events of a particular category and severity. 

• Claim 51 . (Previously Presented) The method of claim 50, wherein the 
enumeration is a histogram having a magnitude based on the severity 
scale and a quantity of events within each severity level within the severity 
ranking; and 

wherein each chart entry has a manageable entity histogram bar, 
the manageable entity histogram bar arranged, for each node, according 
to increasing severity scale denoting the severity ranking for each node 
included in the chart entry, and further comprising computing the severity 
scale for each node according to a predetermined severity metric. 

• Claim 52. (Previously Presented) The method of claim 51 , wherein each 
event in an event category has a set of threshold values, the threshold 
values indicative of a quantitative metric triggering the particular event and 
severity; and 

further comprising processing and propagating the threshold values 
to remote agents, the remote agents operable to analyze nodes and 
determine when a particular metric satisfying a triggering threshold is 
attained and generate the corresponding event. 



Allowable Subject Matter 

3. The following is an examiner's statement of reasons for allowance: 
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Prior art singly or in combination fails to teach claim limitation, among other 
things, the combination of the status array is an N by M matrix of the plurality of chart 
entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in the 
storage area network; 

ii) a storage chart entry indicating alert status of managed storage entities in the 
storage area network; 

ill) a host chart entry indicating alert status of managed host entities in the 
storage area network; and 

iv) a connectivity chart entry indicating alert status of managed connectivity 
entities in the storage area network; and 

displaying the status array including simultaneously listing, for each category 
type, nodes having status events of greatest severity; and 

displaying, within at least one chart entry, node entries in relation to the selected 
at least one node in order to display the simultaneous status of nodes in the storage 
area network. 

• Claims 2-1 5, 1 7, 1 9, 24-27, 30-32, 34, 38-40 and 44-52 carry dependency 
from base claims 1 , 18, 35 and 44, which further limits the base claims. 
Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 
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Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Luo et al, Patent Number US 7,1 39,81 9 B1 . 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to TAUQIR HUSSAIN whose telephone number is 
(571)270-1247. The examiner can normally be reached on 7:30 AM to 5:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on 571 272 3964. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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